Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <58d8d5e1-bb9d-afb1-7606-593067da71fb@apache.org>
Date: Tue, 26 Dec 2023 10:17:25 +0000
From: Nicolas Malin <nmalin@...che.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2023-50968: Apache OFBiz: Arbitrary file properties reading
 and SSRF attack 

Severity: important

Affected versions:

- Apache OFBiz through 18.12.10

Description:

Arbitrary file properties reading vulnerability in Apache Software Foundation Apache OFBiz when user operates an uri call without authorizations.

The same uri can be operated to realize a SSRF attack also  without  authorizations.

Users are recommended to upgrade to version 18.12.11, which fixes this issue.

Credit:

Yun Peng - 郭 运鹏 <puata123@...look.com> (finder)

References:

https://ofbiz.apache.org/download.html
https://ofbiz.apache.org/security.html
https://ofbiz.apache.org/release-notes-18.12.11.html
https://issues.apache.org/jira/browse/OFBIZ-12875
https://ofbiz.apache.org/
https://www.cve.org/CVERecord?id=CVE-2023-50968

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.